feat(panel): add modular landing page builder, public landing page, and hosted launcher downloads

panel/server/tests/api.rs

@@ -223,3 +223,33 @@ async fn settings_never_leak_curseforge_key() {
     let (s, _) = t.call("PUT", "/api/admin/settings", Some(&admin), Some(json!({"public_url": "ftp://nope"}))).await;
     assert_eq!(s, StatusCode::BAD_REQUEST, "public URL must be http(s)");
 }
+
+#[tokio::test]
+async fn landing_page_config_and_permissions() {
+    let t = setup().await;
+    // 1. Public landing endpoint accessible without authentication
+    let (s, v) = t.call("GET", "/api/v1/landing", None, None).await;
+    assert_eq!(s, StatusCode::OK);
+    assert_eq!(v["brand_name"], "SCOPENET");
+    assert_eq!(v["enabled"], true);
+    assert!(v["blocks"].as_array().unwrap().len() >= 5);
+
+    // 2. Unauthenticated user cannot modify landing config
+    let (s, _) = t.call("PUT", "/api/admin/landing", None, Some(json!({"brand_name": "Hacked"}))).await;
+    assert_eq!(s, StatusCode::UNAUTHORIZED);
+
+    // 3. Admin can update landing config
+    let admin = t.login("admin", "supersecret").await;
+    let mut updated = v.clone();
+    updated["brand_name"] = json!("PixelCraft");
+    updated["hero_title"] = json!("Welcome to PixelCraft");
+    let (s, v2) = t.call("PUT", "/api/admin/landing", Some(&admin), Some(updated)).await;
+    assert_eq!(s, StatusCode::OK);
+    assert_eq!(v2["brand_name"], "PixelCraft");
+    assert_eq!(v2["hero_title"], "Welcome to PixelCraft");
+
+    // 4. Public endpoint reflects the updated config
+    let (s, v3) = t.call("GET", "/api/v1/landing", None, None).await;
+    assert_eq!(s, StatusCode::OK);
+    assert_eq!(v3["brand_name"], "PixelCraft");
+}